CVE-2006-2230
published 2006-05-05CVE-2006-2230: Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in…
PriorityP423medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
7.09%
93.4th percentile
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xine-ui | < xine-ui 0.99.4-2 (bookworm) | xine-ui 0.99.4-2 (bookworm) |
| xine | xine | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rm7g-xfrp-h3v4: Multiple format string vulnerabilities in xiTK (xitk/main
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2006-2230 [HIGH] GHSA-rm7g-xfrp-h3v4: Multiple format string vulnerabilities in xiTK (xitk/main
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability.
OSV
CVE-2006-2230: Multiple format string vulnerabilities in xiTK (xitk/main
osv·2006-05-05·CVSS 7.5
CVE-2006-2230 [HIGH] CVE-2006-2230: Multiple format string vulnerabilities in xiTK (xitk/main
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability.
Debian
CVE-2006-2230: xine-ui - Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 migh...
vendor_debian·2006·CVSS 7.5
CVE-2006-2230 [HIGH] CVE-2006-2230: xine-ui - Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 migh...
Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.4 might allow attackers to cause a denial of service via format string specifiers in an MP3 filename specified on the command line. NOTE: this is a different vulnerability than CVE-2006-1905. In addition, if the only attack vectors involve a user-assisted, local command line argument of a non-setuid program, this issue might not be a vulnerability.
Scope: local
bookworm: resolved (fixed in 0.99.4-2)
bullseye: resolved (fixed in 0.99.4-2)
forky: resolved (fixed in 0.99.4-2)
sid: resolved (fixed in 0.99.4-2)
trixie: resolved (fixed in 0.99.4-2)
No detection rules found.
No writeups or analysis indexed.
http://www.debian.org/security/2006/dsa-1093http://www.securityfocus.com/archive/1/432598/100/0/threadedhttp://www.securityfocus.com/bid/17769https://exchange.xforce.ibmcloud.com/vulnerabilities/26216http://www.debian.org/security/2006/dsa-1093http://www.securityfocus.com/archive/1/432598/100/0/threadedhttp://www.securityfocus.com/bid/17769https://exchange.xforce.ibmcloud.com/vulnerabilities/26216
2006-05-05
Published